Solution to Keep the US Government from Snooping

Solution to Keep the US Government from Snooping

In light of continuing news reports of the U.S. government snooping on email and related communications insecurities, Dave Anderson, senior director at Voltage Security offers an engaging commentary. He highlights the value of Solution to Keep the US Government from Snoopingencryption, where the intended email recipient, who is validated, is the one to decrypt the email’s data in order to read it. According to Anderson, the ultimate solution is a stateless key management encryption solution that generates crypto keys on demand, and only when encryption and decryption is needed.

“Email is such a ubiquitous form of communication in business today, not just for simple status communications to employees, but also to distribute content and information outside of the organization to customers, partners and suppliers. Most companies are using email to send sensitive information, including financial, HR, health care and other personally identifiable information, often times without realizing the ease of this information being exposed and lost unless the email and attachments are encrypted. 

“Email can be made private and not subject to exposure or snooping, if the proper encryption methods are implemented to protect the email and all attachments end-to-end, all the way through to the intended recipient. Identity-based encryption, which employs a user’s identity as part of the algorithm to generate the encryption keys on-demand, can effectively encrypt and secure email content and corresponding attachments, both structured and unstructured data, and can maintain that level of encryption from the moment it is created until it is decrypted and read by the intended recipient.

“Many of the surveillance programs in the recent news have employed a process not where they are breaking the crypto, but simply sniffing the email and payload content either before it has been encrypted or after it has been decrypted before it’s sent to the recipient. Gateway solutions are common in these scenarios where the sniffing happens at the gateway, once the gateway receives a clear text email but before the gateway encrypts, or alternatively once the recipient’s gateway receives the encrypted email and then decrypts, but before it gets sent to the recipient.  

“Email security has been available since the dot-com era began as PKI programs provided encryption solutions that could be integrated and used within common email systems.  However, these PKI-based solutions were very difficult to properly deploy. They were very manual in nature and therefore, not user friendly, and often the integration with email systems was difficult and not seamless.  Many companies did not deploy email encryption at this time simply because of these issues, although continued to use email to communicate sensitive information, assuming that other security controls, such as user access and authorization, VPN, or DLP solutions, would keep their email secure, which obviously hasn’t been the case.

“PGP, and other PKI-based encryption solutions, force the customer to adopt a manual, difficult process for generating and managing the crypto keys and certificates used to encrypt, decrypt, and validate users. The key management behind these systems is very difficult for the average enterprise to adopt, and is quite costly over the long run, as the management processes for these systems require a great deal of manual activity and oversight. A better alternative is a stateless key management encryption solution, where crypto keys are generated on demand, only when the user needs to encrypt and decrypt.  Stateless key management, combined with an identity-based encryption solution, completely removes the complexity, cost, and management overhead from an email encryption solution, and can be rapidly adopted and integrated into an enterprise.”

  • Ahead of Current Events Ahead of Current Events

    In this episode, Ralph C. Jensen chats with Dana Barnes, president of global government at Dataminr. We talk about the evolution of Dataminr and how data software benefits business and personnel alike. Dataminr delivers the earliest warnings on high impact events and critical information far in advance of other sources, enabling faster response, more effective risk mitigation for both public and private sector organizations. Barnes recites Dataminr history and how their platform works. With so much emphasis on cybersecurity, Barnes goes into detail about his cybersecurity background and the measures Dataminr takes to ensure safe and secure implementation.

Digital Edition

  • Security Today Magazine - November December 2022

    November / December 2022


    • Key Tech Trend
    • Is Your Access Control System Cyber Secure?
    • Constantly Evolving
    • The Talent Shortage
    • Looking Forward to 2023

    View This Issue

  • Environmental Protection
  • Occupational Health & Safety
  • Spaces4Learning
  • Campus Security & Life Safety